Central Deployment of Hotfixes and Version Upgrades

Introduction

Use Central Deployment in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to perform batch deployment of:

• Jumbo Hotfix Software package installed on top of the current software version to fix a wrong or undesired behavior, and to add a new behavior. Accumulators and Hotfixes on Security Gateways and Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. Members.

• Upgrade Packages on Security Gateways, Cluster Members, Log Servers and secondary management.

• Uninstall Jumbo Hotfix Accumulators and Hotfixes.

You can Deploy a Hotfix or Upgrade Package from:

• The Check Point Cloud.

• The Package Repository Collection of software packages that were uploaded to the Management Server. You can easily install these packages in SmartConsole on the managed Security Gateways. on the Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..

  First, you must upload the applicable package to the Package Repository. See Adding a package to the Package Repository.

To use Central Deployment through the API, see the Check Point Management API Reference.

Best Practice - Use the Package Repository on the Management Server if the target's connectivity to the Management Server is better than the target's connectivity to the cloud, or if the target is overloaded with traffic.

Note - You can select up to 30 Security Gateways and Cluster Members, but installation can take place only on 10 targets at the same time. The Management Server places each target above the 10th in a queue. Each time an installation completes on one of the targets, the Management Server installs it on the next target in the queue.

You can deploy a Recommended Jumbo Hotfix Accumulator Collection of hotfixes combined into a single package. Acronyms: JHA, JHF, JHFA. or a specific Jumbo Hotfix Accumulator take.

Prerequisites

To use Central Deployment:

• The administrator must have SmartUpdate Legacy Check Point GUI client used to manage licenses and contracts in a Check Point environment. write permission on the Management Server.

• The latest build of the CPUSE Check Point Upgrade Service Engine for Gaia Operating System. With CPUSE, you can automatically update Check Point products for the Gaia OS, and the Gaia OS itself. Deployment Agent must be installed on the target Security Gateways and Cluster Members or on the Management Server.

• SIC Secure Internal Communication. The Check Point proprietary mechanism with which Check Point computers that run Check Point software authenticate each other over SSL, for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server. must already be established between the Management Server and the target Security Gateways and Cluster Members.

• A policy must be installed on the target Security Gateways and Cluster Members.

• Only full clusters can be selected (you cannot select one cluster member Security Gateway that is part of a cluster.).

To use Central Deployment directly from the Check Point Cloud:

1. The Management Server must be able to connect to the Check Point Cloud.

2. The target Security Gateways and Cluster Members must be able to connect to the Check Point Cloud.

Limitations

• Upgrade from the R80.30, R80.20, and R80.10 versions (to upgrade from these versions to a higher version, use the CPUSE in-place upgrade).

• Central Deployment does not support:

  • Connecting from SmartConsole to the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. through a proxy server.
    In this case, use the applicable API command.

  • ClusterXL in Load Sharing mode.

  • VRRP Cluster.

  • Security Group in Maestro.

  • Security Group on Scalable Chassis 40000 / 60000.

  • ElasticXL Cluster.

  • For Centrally Managed Quantum Spark Appliances running Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Embedded operating system:

    • Downloading the package from the Check Point Cloud. You must manually add the required package to the Package Repository on the Security Management Server.

    • When using SmartConsole Central Deployment to install a firmware package of the same version, but of a lower build number than is already installed on a Quantum Spark appliance, the "Verify" action does not compare the firmware build numbers. Therefore, SmartConsole shows that "The package is valid for installation", while in fact, the installation will fail by design.

  • On Multi-Domain Servers, SmartConsole connected to the Global Domain, or the Multi-Domain Server Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS. context.

Installation

Notes: If different targets have different recommended Hotfixes or Upgrade Packages, each target gets its applicable recommended Hotfix or Upgrade Package. Before you install a firmware on a Quantum Spark appliance that runs Gaia Embedded operating system, you must disconnect an external storage from the USB port (at minimum, make sure it does not contain firmware images for Quantum Spark appliances).

Uninstalling a Hotfix or a Jumbo Hotfix Accumulator

To uninstall a Hotfix or a Jumbo Hotfix Accumulator

1. From the left navigation panel, click Gateways & Servers.

2. Select the target Security Gateways or Cluster Members for deployment.

   To select multiple targets, press and hold the CTRL key.

   To uninstall the package on Cluster Members, select the cluster object.

3. From the toolbar menu, click Actions and select Uninstall Hotfix/Jumbo.

   The Uninstall Hotfix/Jumbo window opens.

4. In the Hotfix/Jumbo section, enter the Hotfix/Jumbo to uninstall.

5. In the Gateways section, see the targets you selected for uninstalling the Hotfix or Jumbo Hotfix Accumulator.

6. At the bottom, click Verify.

   The verification process starts. The verification process makes sure all necessary conditions are met so that the selected Hotfix or Jumbo Hotfix Accumulator can be uninstalled from the targets.

   To see the progress of the verification process open the Tasks view in the bottom left corner of SmartConsole and click Details.

7. Click Uninstall.

How the Central Deployment Upgrades a Cluster

When you use the Central Deployment to install a software package on all members of a ClusterXL in High Availability mode or VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Cluster (non-VSLS), the Central Deployment follows these steps:

1. Verifies that the states of the Cluster Members are valid (Active and Standby).

2. Prepares the Access Control Policy for the Cluster:

   1. Changes the version in the Cluster object.

   2. Changes the applicable configuration settings and Access Control Policy.

3. Upgrades the Standby Cluster Member to the new version.

4. Runs a Multi-Version Cluster (MVC):

   1. Makes sure the upgraded Cluster Member is in the Standby or Ready state.

   2. Performs cluster failover to one of the upgraded Cluster Members.

5. Upgrades the former Active Cluster Member.

6. Verifies that the states of the Cluster Members are valid (Active and Standby).